EEdukron DevOps Library
SecurityAdvanced14 submodules

DevSecOps Security Scanning

Place complementary security tests across source, dependencies, secrets, images, infrastructure code, and running applications, then convert findings into risk-based delivery gates.

How this module works

From concept to production evidence

Scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Learning outcomes

  • Differentiate SAST, DAST, and SCA
  • Implement secret, container, dependency, and IaC scanning
  • Use SonarQube, Trivy, Snyk, Gitleaks, and OWASP tooling appropriately
  • Prioritize findings by exploitability and exposure
  • Create security gates and exception workflow

Flow diagram

DevSecOps Security Scanning end-to-end flow

Use this sequence as the operating backbone for every submodule note and hands-on exercise.

  1. 01
    Change codeDevSecOps Security Scanning stage 1: change code with an auditable result before the next stage begins.
  2. 02
    Scan source and secretsDevSecOps Security Scanning stage 2: scan source and secrets with an auditable result before the next stage begins.
  3. 03
    Resolve dependenciesDevSecOps Security Scanning stage 3: resolve dependencies with an auditable result before the next stage begins.
  4. 04
    Scan package and imageDevSecOps Security Scanning stage 4: scan package and image with an auditable result before the next stage begins.
  5. 05
    Deploy test targetDevSecOps Security Scanning stage 5: deploy test target with an auditable result before the next stage begins.
  6. 06
    Run DAST and enforce gateDevSecOps Security Scanning stage 6: run dast and enforce gate with an auditable result before the next stage begins.

Official Microsoft reference

Architecture diagrams from Microsoft documentation

Use these diagrams beside the original Edukron notes and flows to compare the learning model with the official product and architecture view.

Official Microsoft architecture for building and deploying AKS applications with Azure Pipelines, ACR, security, and observability.

Azure Pipelines CI/CD architecture for AKS

The architecture connects PR validation, CI, container registries, staged AKS deployment, promotion, security scanning, Key Vault, Azure Monitor, Prometheus, Grafana, and Log Analytics.

Integrated hands-on lab

Build a layered DevSecOps pipeline

  1. Add secret and SAST scans
  2. Add SCA and dependency policy
  3. Scan IaC and container image
  4. Run DAST against a test environment
  5. Create severity gate and exception record

Complete module contents

14 full submodule notes

Read in order
01

Shift-left security

Shift-left security controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
02

SAST

SAST provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
03

DAST

DAST provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
04

SCA

SCA provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
05

Secret scanning

Secret scanning controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
06

Container scanning

Container scanning moves a versioned change toward users through repeatable validation, immutable artifacts, controlled promotion, and recoverable release decisions within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
07

IaC scanning

IaC scanning provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
08

SonarQube

SonarQube provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
09

Trivy

Trivy provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
10

Snyk

Snyk provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
11

Gitleaks

Gitleaks provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
12

OWASP

OWASP provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
13

Dependency scanning

Dependency scanning provides a concrete platform capability that must be configured, secured, validated, observed, and owned throughout its lifecycle within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes
14

Security gates

Security gates controls which actor may perform which action on which resource, under which conditions, with evidence that can be reviewed later within DevSecOps Security Scanning. It is not an isolated definition: its value appears when it supports scan the earliest artifact that can reveal a risk, avoid relying on one tool, protect scanner credentials, tune rules with security ownership, retain reports, and treat exceptions as expiring risk decisions.

Open full notes